Product:
Adobe Flash Player
Summary
Adobe Flash Player versions before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X, and before 11.2.202.457 on Linux, allow attackers to execute arbitrary code or cause a denial of service due to memory corruption. This vulnerability was actively exploited in April 2015 and is distinct from several other CVEs.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2015-3043 |
Exploitation
Attackers can exploit this vulnerability by sending specially crafted content to the affected versions of Adobe Flash Player. This content can trigger memory corruption, allowing the attacker to execute arbitrary code on the victim’s system or cause a denial of service. The exploitation does not require user interaction, making it particularly dangerous.
Affected Products
- Adobe Flash Player for Windows and OS X (versions before 13.0.0.281 and 14.x through 17.x before 17.0.0.169)
- Adobe Flash Player for Linux (versions before 11.2.202.457)
Mitigation
The impacted product is no longer supported and should be disconnected from networks if still in use. Users are encouraged to transition to alternative solutions that are actively maintained and secure.
References
- OpenSUSE Security Announcement 1
- OpenSUSE Security Announcement 2
- OpenSUSE Security Announcement 3
- OpenSUSE Security Announcement 4
- Red Hat Security Advisory
- SecurityFocus BID 74062
- SecurityTracker ID 1032105
- Adobe Security Advisory APSB15-06
- Gentoo GLSA 201504-07
- Exploit-DB Entry
- CISA Known Exploited Vulnerabilities Catalog